Evil-DB LogoEvil-DB
← All CVEs

CVE-2024-20767

high · 7.4Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Added 2024-12-16Remediation due 2025-01-06

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this issue does not require user interaction. Exploitation of this issue requires the admin panel be exposed to the internet.

7.4
CVSS
98.5%
EPSS (exploit prob.)
100th
EPSS percentile
2024-03-18
Published

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-284

Affected products

VendorProductAffected versions
adobecoldfusion2021
adobecoldfusion2021
adobecoldfusion2021
adobecoldfusion2021
adobecoldfusion2021
adobecoldfusion2021
adobecoldfusion2021
adobecoldfusion2021
adobecoldfusion2021
adobecoldfusion2021
adobecoldfusion2021
adobecoldfusion2021
adobecoldfusion2021
adobecoldfusion2023
adobecoldfusion2023
adobecoldfusion2023
adobecoldfusion2023
adobecoldfusion2023
adobecoldfusion2023
adobecoldfusion2023

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-20767